[CTX-1050] docs(security): record R-001/R-002 Open-to-Mitigated moves

[Xuepoo]

Scope

Records the auditor-authorized R-001/R-002 Open-to-Mitigated moves in the evidence matrix and risk register (CTX-1050, EPIC bitty-terminal/bitty#975). Docs-only change; no product code.

• R-001 cites audit bitty docs/security/audits/vt-parser-2026-09.md at 8c41f1e (PR 130); R-002 cites rich-image-2026-09.md at 8e6c8a9 (PR 132).
• R-001 long-running cargo-fuzz campaign kept as an outstanding residual.
• Risk lifecycle stays Open to Mitigated to Accepted; no Accepted claim.
• FIND-0002 wave rows untouched (Implemented-only, R-007 precedent).

Verification

• just check: green (fmt-check, markdownlint, links, cross-repo offline, metadata, language, agents, hygiene, state, actionlint).
• act -n -W .github/workflows/ci.yml: dry-run success.
• Prettier table re-padding is mechanical (audit column resized to widest cell); git diff -w shows only R-001/R-002 rows plus prose.

Task linkage

Priority: P0 | Area: area:security | Labels: docs,area:security,P0 | Milestone: v0.1.0 | RFC: risk-evidence-rfc | Task: CTX-1050

Review and merge are commander's job; stopping here per task brief.